GIH: Shocking information has come forth that government officials responsible for cybersecurity initiatives do not have basic knowledge about the internet, such as what an “ISP” is. How can those who know nothing about a topic regulate or execute it?
One of the world’s leading cyberwarfare experts has warned of the damaging lack of government literacy in cybersecurity issues, pointing out that some senior officials don’t know how to use email, and that one US representative about to negotiate cybersecurity with China asked him what an “ISP” was.
Speaking at the SXSW festival, Dr Peter W Singer, director of the Center for 21st Century Security & Intelligence, cited a 2014 poll by the Pew research institute that found Americans are more afraid of cyberattack than attack by Iran or North Korea, climate change, the rise of China or authoritarian Russia.
Sketching out the scale of technology in our lives, Singer said that 40 trillion emails are sent a year, that 30 trillion websites now exist and that 9 new pieces of malware are discovered every second. He claimed that 97% of Fortune 500 companies have admitted they’ve been hacked – the other 3% just aren’t ready to admit it yet.
The consequent rise in cybercrime and state-sponsored attacks has not gone unnoticed. 100 nations now have cyber command, and the Pentagon’s own briefings, which contained the word ‘cyber’ 12 times during 2012, have already mentioned it 147 times so far this year.
Yet former head of US homeland security Janet Napolitano once told Singer. “Don’t laugh, but I just don’t use email at all,” Singer recalled. “It wasn’t a fear of privacy or security – it’s because she just didn’t think it was useful. A supreme court justice also told me ‘I haven’t got round to email yet’ – and this is someone who will get to vote on everything from net neutrality to the NSA negotiations.”
Obama himself, Singer said, had expressed concern that the complexity of the issue was overwhelming policy makers.
Singer added that another US official about to negotiate cybersecurity with China asked him to explain what “ISP” meant. “That’s like going to negotiate with the Soviets and not knowing what ‘ICBM’ means. And I’ve had similar experiences with officials from the UK, China and Abu Dhabi.
At the G20 conference diplomats were spearfished by an email with a link to nude photos of former French first lady Carla Bruni-Sarkozy, and many clicked – downloading spyware onto their computers.
“Cybersecurity is crucial, and as intimate to your life as your bank account. It’s treated as an area only for IT folk, and the technical community that understands the hardware and software but not the wetware – the human side. Without proper tools we cannot understand both what is possible and what is proper. Past myth and future hype weave together to obscure to what actually happen with where we will be in the future.”
Cybersecurity should be treated like public health
Singer also said many cybersecurity threats and solutions are misrepresented or overblown. Power lines are taken down far more often by squirrels, for example. The government response is often too reactionary – akin to the treatment of pirates and privateers in the age of sail – whereas investment in a public cyberhealth campaign would be far more effective.
“Ben Franklin said an ounce of prevention is worth a pound of cure. The Centre for Disease Control and Prevention says that is true of public health but it is also true of cybersecurity… very basic cyber hygiene would go an very long way. The top control measures would stop 90% of all cyber attacks.”
The most significant penetration of US secure networks happened when an infected USB stick was dropped in the car park after a ‘candy drop’; an employee picked it up and plugged it into his computer on their secure network. “That’s not cyber hygiene, that’s basic hygiene – the five second rule.”
Another problem is that different parts of government operate in contradiction to each other. “Tor was originally paid for by Navy money, and pushed by state departments as a way of dissidents and state departments to protect themselves simultaneously, but if you use it you get swept up by the NSA who assumes you are up to no good. We have to figure out these balances.”
Snowden – traitor or hero?
The argument over NSA surveillance has been reduced to bumper sticker values, Singer argued.
Three different kinds of activity have been exposed. The first is that the NSA carries out espionage against American enemies – smart, strategic espionage. The second is legally and politically questionable, and related to mass collection of American citizens’ information collected either directly by the agency or by its allies.
“The third is what you could kindly call unstrategic – or stupid – directly targeting close American allies and leaders and undermining American technology companies. People want to say Snowden was a traitor or a whistleblower and we pull from the bucket we care the most about, but that’s a bumper sticker way of talking about it because people can simultaneously do both good and bad actions.”
• Julian Assange tells SXSW audience: ‘NSA has grown to be a rogue agency’
